Skip to main content
The API is versioned in two places:
  • The URL major version, /v1, for the shape of the API as a whole. Every route on this site lives under /v1.
  • The date version, sent as the X-ENSC-API-Version header, for the contract you were built against. The current version is 2026-09-15.
Pinning the date version means an API change cannot silently alter behaviour under a deployed integration. Every response carries the version it was served with in its own X-ENSC-API-Version header.

​
What the SDK does

@ensc/sdk sends the pinned header on every request. DEFAULT_API_VERSION is 2026-09-15 in 0.3.0 and later; 0.4.1 requires API date version 2026-09-15 (unchanged from 0.4.0). Upgrading the SDK is how you adopt a newer date version. Read the changelog before adopting a newer version.

​
What changed in 2026-09-15

Version 2026-09-15 introduced mandatory payload encryption: every write body is an ENSC-ENC-V1 envelope, and every successful response is an ENSC-RESP-V1 sealed body. Plaintext merchant writes are refused with ENSC_ENCRYPTION_REQUIRED. SDK versions before 0.3.0 send plaintext requests the API refuses, and versions before 0.4.0 call routes that no longer exist and receive ENSC_NOT_FOUND. The full list is in the changelog.

​
Webhook payloads

A webhook endpoint can pin the payload version its deliveries use (apiVersion when you register it; defaults to the current version). Each delivery states its version in the body (apiVersion) and in the X-ENSC-API-Version header. See Webhooks.

​
The published reference

The API reference tab of this site is generated from the OpenAPI document for 2026-09-15, and each operation there shows the @ensc/sdk call that makes it. The API serves the same material itself: When a new date version ships, a new document is published and the changelog records the differences.